Search Linux Wireless

[PATCH 09/15] staging: brcm80211: fix off-by-one error in swap functions

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



From: Henry Ptasinski <henryp@xxxxxxxxxxxx>

The original implementation iterated over the data in buf+1 through buf+size,
whereas it should have been over the data in buf through buf+size-1.

Tested on Mac G5 PPC and BCM63281.

Signed-off-by: Henry Ptasinski <henryp@xxxxxxxxxxxx>
Reviewed-by: Arend van Spriel <arend@xxxxxxxxxxxx>
Reviewed-by: Roland Vossen <rvossen@xxxxxxxxxxxx>
Tested-by: Jonas Gorski <jonas.gorski@xxxxxxxxx>
Signed-off-by: Arend van Spriel <arend@xxxxxxxxxxxx>
---
 drivers/staging/brcm80211/brcmsmac/srom.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/brcm80211/brcmsmac/srom.c b/drivers/staging/brcm80211/brcmsmac/srom.c
index 060f06f..7a17f59 100644
--- a/drivers/staging/brcm80211/brcmsmac/srom.c
+++ b/drivers/staging/brcm80211/brcmsmac/srom.c
@@ -880,13 +880,15 @@ int srom_var_init(struct si_pub *sih, void *curmap, char **vars, uint *count)
 
 static inline void ltoh16_buf(u16 *buf, unsigned int size)
 {
-	for (size /= 2; size; size--)
+	size /= 2;
+	while (size--)
 		*(buf + size) = le16_to_cpu(*(buf + size));
 }
 
 static inline void htol16_buf(u16 *buf, unsigned int size)
 {
-	for (size /= 2; size; size--)
+	size /= 2;
+	while (size--)
 		*(buf + size) = cpu_to_le16(*(buf + size));
 }
 
-- 
1.7.4.1


--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Device Mapper]
  Powered by Linux